Filtered antivirus scanning

Abstract

An antivirus client module (114) includes a virus definitions module (312) holding information describing characteristics of files that can potentially be infected by viruses and information enabling a determination of whether a file is actually infected by a virus. The client module (114) also includes a filtering module (314) having a file information cache (410) describing characteristics of files. A file scanning module (316) can scan files to determine whether the files are infected by viruses. The antivirus client module (114) queries the file information cache (410) using the information describing characteristics of files to identify the set of files that are susceptible to a given virus. The file scanning module (316) scans the files in the set.

Description

BACKGROUND OF THE INVENTION[0001]1. Field of the Invention[0002]This invention pertains in general to detecting computer viruses and in particular to techniques for enabling faster antivirus scanning.[0003]2. Background Art[0004]Modern computer systems are under constant threat of attack from computer viruses and other malicious code. Viruses often spread through the traditional route: a computer user inserts a disk or other medium infected with a virus into a computer system. The virus infects the computer system when data on the disk are accessed.[0005]Viruses also spread through new routes. A greater number of computer systems are connected to the Internet and other communications networks than ever before. These networks allow a computer to access a wide range of programs and data, but also provide a multitude of new avenues by which a computer virus can infect the computer. Some viruses exploit the broad reach of the networks and can spread rapidly to thousands or millions of c...

AI Technical Summary

Benefits of technology

[0009]The above need is met by an antivirus client module (114) that identifies the set of files that are susceptible to a given virus, and scans only those files to determine whether they are infected by the virus. In one embodiment, the antivirus client module (114) includes a virus definitions module (312) holding information describing characteristics of files that can potentially be infected by viruses and information enabling a determination of whether a file is actually infected by a virus. The antivirus

Problems solved by technology

Modern computer systems are under constant threat of attack from computer viruses and other malicious code.

The virus infects the computer system when data on the disk are accessed.

This task has become more difficult in recent times because the number of files on a typical computer system has increased dramatically.

Thus, there is a much larger pool of potentially-infected files that the antivirus software must scan.

Moreover, scanning an individual file for the presence of a virus takes longer now than in the past.

As a result, antivir

Images